Small Business AI Policy: A One-Page Template for Your Team

A small business AI policy is a short set of rules for how your team uses AI tools: which ones, with what data, and who approves what. Most founder-led businesses don't have one. Their team uses whatever free app they found, pastes in whatever they're working on, and nobody knows what's been shared. This fall gave every owner three good reasons to fix that, and it takes about an hour.

Below is why it matters now, plus a one-page template you can adapt today.

Why your small business AI policy can't wait

Three changes in the last few weeks show how fast the tools under your team's feet are moving.

Free plans are changing. Starting October 9, Google limited free Gemini users to its lighter Flash-Lite model, with stronger models on paid tiers. If your team uses personal free accounts for work, the quality of their output just changed, and you probably didn't know which accounts they were using in the first place.

AI is reaching into money and records. OpenAI's Finances feature lets people connect bank accounts and credit data to ChatGPT. That's for personal use, but it's a sign of where things are heading: AI connected to sensitive systems.

Agents can now act, not just answer. Meta launched Muse for Small Business, which Retail Dive reports can work across Shopify, Stripe, QuickBooks and other tools, with an option to require human approval before purchases or publishing.

When AI can read your books and post on your behalf, "use your judgment" isn't a policy anymore.

Find out what's already in use

Before you write anything, spend 15 minutes learning what your team already does. Ask everyone the same three questions, anonymously if that helps people answer honestly:

1. Which AI tools have you used for work in the last month?
2. Are you using a personal account or a company account?
3. What kind of work did you use it for?

You'll likely be surprised, in both directions. Some people will be doing clever things you'll want to share with everyone. Others will have pasted in things that belong on the "never" list. Both answers make your policy better, because it's based on how work really happens instead of how you assume it happens.

What a small business AI policy should cover

Keep it to one page. If it's longer, nobody will read it. Cover five things:

1. Approved tools. Which AI tools are okay for work, and which account to use.
2. Data rules. What can and can't go into an AI tool.
3. Review rules. What a human must check before it goes out.
4. Agent approvals. What an AI agent can do on its own and what needs sign-off.
5. Who to ask. One person who owns the policy and answers questions.

A one-page small business AI policy template

Copy this, change the bracketed parts, and share it with the team.

[Company] AI Use Policy. Updated [date].

1. Approved tools. You may use [ChatGPT Team / Gemini Business / other] with your work account. Don't use personal or free accounts for company work. Ask [owner name] before trying a new AI tool with company data.

2. Never put these into any AI tool:

• Customer payment details or bank information.
• Passwords, logins or API keys.
• Employee personal information (pay, health, Social Security numbers).
• Anything a client asked us to keep confidential.

3. Okay to use AI for:

• First drafts of emails, posts, proposals and job descriptions.
• Summarizing our own documents and meeting notes.
• Research and brainstorming.
• Formulas, spreadsheets and simple reports.

4. A human always reviews:

• Anything a customer will see.
• Any number, price or claim about our results.
• Anything legal, financial or HR related.

5. AI agents. Agents connected to our tools must have approval turned on for purchases, payments, publishing and sending email to customers. Only [owner name] can connect a new agent to [accounting / store / CRM].

6. Mistakes. If you think you shared something you shouldn't have, tell [owner name] the same day. No blame. We'd rather fix it fast.

7. Questions. Ask [owner name].

How to roll it out without slowing anyone down

A policy that blocks everything gets ignored. The goal is to make the safe way the easy way.

• Pay for the business version of one main tool so everyone has a work account. Business plans typically include admin controls that free personal accounts don't.
• Share it in a 20-minute meeting, not just an email. Walk through real examples.
• Give people good prompts for their actual jobs, so they don't need to improvise.
• Review it every quarter. The tools change monthly.

We cover the people side in how to get your team to actually use AI, and the security basics in AI safety basics for business owners.

Common mistakes

• Banning AI. People use it anyway, just on personal accounts you can't see.
• Writing a 12-page policy. Nobody reads it.
• Forgetting agents. Many policies only cover chat. Agents that act on your tools need their own rules.
• No owner. If nobody owns it, it goes stale in a month.

Common questions

Does a 10-person company really need an AI policy? Yes. Small teams share more sensitive data per person, and one mistake hurts more. One page is enough.

Should we let employees use free AI tools? For company work, it's safer to provide a business account. Free plans change without notice, as the Gemini change shows, and you have less control over the data.

Is this legal advice? No. If you handle regulated data, like health or financial records, have your attorney review your policy.

How often should we update it? Every quarter, or any time you add a new tool or agent.

Start with the policy, then go after growth

A clear policy is the boring first step that makes the fun part possible: using AI to win more customers and save real hours. If you want a partner to help build that, starting with an honest look at where growth is waiting, see how we work as a growth partner or begin with a two-week AI audit.